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I REAL PARTY IN INTEREST (37 C.F.R. § 41.37{c){l)(i)) 

The reai party in interest in this appeal is McAfee, Inc. 
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H RE LATED APPEALS AND INTERFERENCES (37 CF.R. § 41.37(c) (1 )(»)) 

Wnh Et-spca to othei pnoi ot pending appeals, mrejreienees, oi related judicial proceedings that 
will dttecth affea oi he chiceth a dec ted hs ot ha\e a beauns/ on the Boatd's dt-uston hi the 
pending appeal an appeal noted on (•(> ('2 200^ in dpplieatiuii sum! immhei 00 Oio oOO ma\ be 
but is not necessarily, related. 

Si net- no deasionb) has been icrideied m such pioceeding{s} no Related P:oc ceding Appendix 

is appended hereto. 
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Mi: STATUS OF CLAIMS (37 C.F.R. § 41.37(c) <I ><iii» 

A. TO IAL M MBER OF CI AIMS IN APPLICATION 

Claims m the ^ppfiCditon dte 1-13 P-2° and 3^-44 

B. STA'l I S Oh ALL TIIL C LAIMS IN APPLICATION 

1 ( Lnms v\tthdia\\n fiom consultation None 

2 (l^jms pending 1-13 i 7-2' ) and 33-44 
i Claims allowed None 

1 Chums i ejeued I - H 1 7-20 and » i- 41 
^ Claims cancelled 14-lo and 30-32 

C. CLAIMS ON A PPEAL 

The claims on appeal are: 1-13, 17-29 and 33-44 

See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R, § 41.37(c)(l)(iv)) 

As to the status of any amendment filed subsequent to final rejection, there are no such 
amendments after final. 
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V SUMMARY OF O AIMED SUBJECT MATTER (37 C.F.R. § 4L37(c){l)(v)) 

With respect to a summary of Claim 1, as shown in Figures 5 and 6, a technique is provided for 
scanning data. In use, scanning contra! logic is executed utilizing a central processing unit {e.g. 
item 502 of Figure 5) and the data is indicated to a scanning co-processor coupled to the central 
processing unit so that the data is scanned by the scanning co-processor under the control of the 
scanning control logic (e.g. item 510/514 (if Figure 5). Results from the scanning co-processor 
are waited for (e.g. decision 516 of Figure 5} and additional logic is executed utilizing the central 
processing unit while waiting for the results from the scanning co-processor (e.g item 514 of 
Figure 5). In addition, an event is initiated based on the results from the scanning co-processor 
fe g. item 518 of Figure 5). The scanning co-processor is also under the control of the central 
processing unit via the execution of the scanning control logic by the central processing unit. 
Furthermore, it is determined whether the data meets a predetermined criteria, where the criteria 
is based on a type of a file associated with the data fe g. item 506 of Figure 5} and the data is sent 
to the scanning co-processor if it is determined that the data meets the predetermined criteria 
fe g. operation 508 of Figure 5). Still yet additional data to be scanned by the scanning co- 
processor is queued while waiting for the results from the scanning co-processor (e.g. item 610 
of Figure 6). Note page 3. line 1-page 4, line 4. for example. 

With respect to a summary of Claim 17, as shown in Figures 5 and 6, a computer program 
product for scanning data comprises computer code for executing scanning control logic utilizing 
a central processing unit (e.g item 502 of Figure 5>, and a request related to data is identified at 
the central processing unit, in addition, the data is indicated to a scanning co-processor coupled 
to the central processing unit so that the data is scanned by the scanning co-processor under the 
control of the scanning control logic fe g. item 510/514 of Figure 5) Additionally, results from 
the scanning co-processor are wailed for (e.g item 5 1 o of Figure 5} and additional logic is 
executed utilizing the central processing unit while waiting for the results from the scanning co- 
processor fe g item 514 of figure 5} Further, an event is initiated based on the results from the 
scanning co-processor (e g. item 518 of Figure 5). The scanning co-processor is under the 
control of the central processing unit via the execution of the scanning control logic by the 
central processing unit Also, it is determined whether the data meets a predetermined criteria. 
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wheie the emena is based on a ts pe ot a file associated v\ Uh the data (e n item *>06 of Figuie 5), 
and the data is seni to the scanning co-processui )} u is detenmned that the data meets the 
ptedeteimmed cnteua <e i> ttetn ^08 ot j iguie 5> further, additional data to he scanned b\ the 
scanning co-pjoccssoi is queued while waiting for the results from ihc .scanning co-ptocessos 
(o a item 650 of FiguieO) \ote page >. line 5 -page 4 line 4 tW example 

With respect to a summatv of ( hum 3 \ as shown tn f mines 5 and o, a svstem foi scanning data, 
comprises logic for executing scanning conuol logic utilizing a central pioeessutg umt (e g item 
^02 of Figure M and logic foi identifs ing a iequest related to data at the cential processing umt 
fn addition the svstem eompnses logic for indicating the data to a scanning co-processor 
coupled to the cents al ptoeessmg umt so that the data is scanned b\ the scanning co-pioeessoi 
undet the conuol of the scanning conuol logic <e g item Mo M4 of hguic 5") AJditionalK the 
ss »tem complices logic for waitma foi results from ihc scanning co-pi ocessoi (e y stent Mb of 
figure M and logic for executing additional logic utilizing the Central processing unit while 
vwnting for the Jesuits fiom the scanning co~piocessor (e g item M4 oi 1 igme 5> Also the 
ss stem eompnses logic for imuatmu an e\ent based on the results from the scanning eo- 
pfvict- ssoj (e g item M H ofl iguie 51 I he scanning eo-processor is under the control of the 
ceuttal pi licensing unit \ia the execution of the scamung control logic b\ the central ptoeessmg 
unit Also, it is determined whethei the data meets a predetermined catena wheie the etituia is 
based on a r\ pe of a file associated with the data <e u item ^Oo ot hgure 5). and the data ts sent 
to the scanning co-puvcssoi if it ts detet mined that the data meets the pi cdetet mined euteru 
te g item m>X oj rigure M f-utther, additional data to he scanned fw the scanning co-processor 
is queued while waiting (oi the tesuits (torn the scanning co-pioeessor (v g stem MO of hgsue 
6} Note pavre 3 hne I -page 4. line 4 fos example 

With respect to a summary of Claim 34. a» shown m hgures and o, a method for scanning data 
coinpiist-s executing scanning control logic utilizing a cential processing umt (e g item m)2 of 
Figure 5} and a request lelated to data ts identified at the centtal piocessing unit in addition u ts 
detes mining whethet the data meets a predetei mined uttena utilizing the cential processing unit 
undet the conuol of the scanning conuol logic <e g item Mo M4 of hguic 51 AdditionalK the 
data is indicated to a scanning co-processor coupled to the Central processing unit if it is 
detei mined that the data meets the piedetei mined catena (e g item ''OS of F tgute M 
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rntthermor e, scanning information is collected from memor \ on the scanning eo-proeesso! (e n 
ftun 602 ol I jgt»e o) and the data is scanned with the scanning eu-proeessui utih/ing the 
.scanning infonnahon under the coottol ol the scanning coottol logic (e g item C>u4 of Fiut. re 0} 
In addition, results from the scanning eo-puvcssoi die waited tot (c g item off iguie and 
additional logic is executed utilising the eenttal ptotessmg unit while waiting for the results from 
the scanning cu-processoi fe g item M4 uf f igute 5) Fuithet additional data to be scanned is 
quel ed bs the scanning eo-processot while wasting foi the jest Us tjom the scanning co- 
processor t'e g item o 10 of figure o) In addition, a security event is initiated upon the iceetpt of 
unfaxorabit results horn the scanning co-processot including a situation where malicious code is 
detected te g item > I ^ ot 1 fgtue ^ ) Addi Monalh the data is piotessed utfii/fng the centi al 
processing unit upon the icceipt of t\v> orahle Jesuits from the scanning eo-processoi including a 
situation where malicious code is not detected <c g item ^20 of f-igme M Also the scanning co- 
processor is undei the control of the central processing unit ua the execution ot the scanning 
conttoi logic hs the central ptoeesstng unit Furthennote the catena is based on a t\ pe of a. File 
associated with the data Vote page 3 line 1-page 4 line 4 and page 1 1 lines 4-°, lot example 

With it-speer to a snmman of Claim 3^ as shown in figures s and 6 a ssstcm for scanning data 
comprises means for executing scanning control logic utilizing a eenttal processing unit <e g 
item 502 off igi ie ^) In addition the s\ stem comprises means for identify mg a request i dated 
to data at the eenttal processing unit «e g item 5' 4 off igure *!) Further, the ssstem com puses 
means foi dctumimnii wheihci the data meets a pit-determined criteria utilizing the eenttal 
processing unit undet the control of the scanning control logic <c g item S(>t> oj figure 
VddMionalh , the system comprises means for indicating the data to a scanning co-processor 
coupled to the eenttal ptocessing unit if it is detenu med that the data meets the pi edeter mined 
catena (e g item m)8 of hgutc furthermore, the s\stem comprises means foi collecting 
scanning information irom memots on the scanning co-processor (e g item o02 of Figure b) in 
addition, the system comprises means for scanning the data with the scanning co-processor 
utilizing the scanning information under the control of the scantling control logic (e.g. item 604 
of Figure 6). Further, the system comprises means for waiting for results from the scanning co- 
processor (e.g. item 516 of Figure 5). Still yet the system comprises means for executing 
additional logic utilizing the central processing unit while waiting for the results from the 
scanning co-processor (e.g. item. 5 .14 of Figure 5). hi addition, the system comprises means for 
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queuing additional data to be scanned b\ the sedmimg eo~pioeessoi while udumg for the tesiiits 
ftom tlit, scanning (.o-psocessor (o g item f>10 of hgure o> Furtheiinuic tbc s\stum Loinptivs 
nitons foi initiating a securm o ent upon the iccupt ot unt> or able Jesuits Irom the scanning 
to-ptvKt-SbOi including a situation where malicious code is detected (e g item ^ i 8 of t iguie s ) 
Also, the s\ stem comprises means for ptocessmg the data utilising the central pressing unit 
upon the receipt of Uuouble lesulfs hom the scanning eo-proeessor including a situation vsliue 
malicious code is not detected <e g stem 520 of Figuie ^) 1 he scanmna co-pjocessor is t udet 
the control of the central processing unit ua the execution of the scanning contsol logic b\ the 
central ptoeessmg unit Ftnthet the ciitena is based on ,\ ts pe ot a trie associated v\ith the data 
Note page hnel-p«mc4 line 4 for example 
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VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 C.F.R. § 
4L37{c)(l){vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground of 
rejection. 

Issue it- 1: The Examiner has rejected Claims 2, 18, and 34-37 under 35 U.S.C. 1 12, second 
paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject 
matter which appellant regards as the invention. 

issue #2; The Examiner has rejected Claims 1-2, 4- 1 3, 17- i S, 20-29, 33-35, 38-40.. 42 and 44 
under 35 V S C. 102(e) as being anticipated by Grupe et al. (U.S. Publication No. 
2002/01942.12). 

Issue £3: The Examiner has rejected Claims 3, 10, 36, 41 and 43 under 35 U.S.C. 103(a) as 
being unpatentable over Gatpe et ai. (U.S. Publication No. 2002/0194212), in view of Zuta 
(International Publication No. WO 98/45778) 

Issue #4: The Examiner has rejected Claim 37 under 35 U.S.C. 1 03(a) as being unpatentable over 
Grupe et ai. (U.S. Publication No. 2002/0194212), in view of Snaveiy (Snaveiy, Allan; Tullsen, 
Dean. Symbiotic Jobschedultng for a Simultaneous Multithreading Processor Published in the 
Proceedings of ASPLOS IX. November 2000), 
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VII VRG C >1 K \ V (37 C.K R.§ 4 U7<e)< 

1 he claims ol the groups noted below do not stand oj fall together In the present section, appellant 
explains wh\ the claims of oath gioup aic belsex ed t*^ be separated patentable 

issue g 1. •. 

1 he fc\ammei has rejected C faint* 2. IS and >4- >7 under I S C 112 second paiagiaph as 
bt*i n indefinite tor fading to parhculaih point out and disuncth Uaim the subject matter which 
appellant regdids as the invention \ppeliaut iespeetfnlh disagiees wuh the P\<nninei s 
rejection Speeiikalh the ! xaminer amied that there is no defimtn e standard for ascertaining 
what constitutes l favOi able lehUlttT and l unfa\orablc results " Howexei appellant respectful l\ 
assests that appellant danus unfa\ or able results" as mdudmg a situation where maiieious code 
is detected ' (emphasis added) and "fa vol able Jesuits" as 1 including a situation where malicious 
code is not detected ( emphasis added) as claimed Clear h , appellant s claimed technujues .set 
the standards for "favorable results" and "unfavorable results." 

Issue #2: 

The lAammerhas i ejected Claims 1-2 4-13. I"- 1 8.20-2" 33-.?\ 38-4". 42 and 44 under 
I S(. 102(e) as being anticipated b\ Orupectal (US Publication \o 2002/0 1 o.j : 1 2 ) 

Group HI: Claims 1, 4-7, 9-1 1, 13, 17. 20-23, 25-27 f 29, 33, 40, mid 42 

he Examiner has relied on Paragraphs 0008, and 0000 from Orupe to meet appellant's claimed 
technique "w herein the scanning co-processor is under- the control of the central processing unit 
via the execution of the scanning control logic by the central processing unit" (see this or similar, 
but not necessarily identical language in the independent Claims 1,17, and 33). 

pE'i'i!^" •.->;[;;■.: I £; a computer program operable to control a 

scanning computer to produce a log file identif ying computer data from 
a source computer having specified content, s:fi i ccj^uj" ■=■ f j:. .=:•:-. 



v j - " , f " v " s " sv. To address 

thi«! problem embodiments of the invention transfer data to be scanned 
from a sourc: computer to a scanning computer The scanning computer 
then scans thy data <and cre<*t«s a log file identifying portions of thy 
data that have predetermined characteristics indicating a particular 
specified coite t 



Vpdhmt iespecttu!S\ assuts that the excerpts from Giupe rehed upon b\ the i \jtnmu meseh 
disclose a computer puHjram opct ^hle to contiol a scanning, computet to produce a lo_g file 
iJentiUmu computet data iiotn a sowee computer hawng specified content Fusthct Ginpe 
drse loses that dat t to he scanned [is ttatisienedj ttom a soutce c-oinpi iei tu a suiiiinm 
computer v hett jtjhe scanning computet then sc\ ns the data ami ueatcs a k% Hie jdenttU iau 
poithms ot tht data that ha\ c picdctenmncd chat it ten sties tndic umg a particular specified 
content (emphasis added) However the mete disclosure ol transfer* mg data front a soutce 
computet to a scanning computet wheie the scanning compute} scans the data and acatcs a log 
file asinOrupe lads to e\en suggest 4 technique whetem the scamu^ co-piotessoi u> umiet 
ihc contiol ot the t tntial ptot casing unit via the execution ot the scanmna control los>ie b\ the 
cettttal proct>stnsJ umt (emphasis added) a Jaimed bs appell tin (leuh st nee the scanning 
computet disposed b\ (uupe ts notundet the comro] ol tht soukc computet then ( tupe tails to 
disclose uheiem the scanning co-ptottssoi ts under the contto! oi the cent) a! ptoccssfng unit 
\ fa the execution ot the scanning contioi logic bs the centtal processing unit (emphasis auded) 
as claimed by appellant. 

1 utthemuue, the 1 \amtnet has tehed on Paragraph 0(}00 from (irnpe to make a pilot art showing 
of appellant s claimed technique whett-in additional data to be scanned b\ the scanning co- 
pi ocessvir is queued while watting for ihc lesuits ftom the scanning co-pjotessof fsee tins or 
Mirnktr, hut u<U necet>sait]\ identical language tti the independent Claims K I "* arid >i) 
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this problem erobodinients of the invention transfer data to b« scanned 
from a source computer to a scanning computer. The scanning computer 
then scans the data and creates a log file identifying portions of the 
data that have predetermined characteristics indicating a particular 
specified content. Tins en.hb !?;,■■> the .source •:;o:Kip\;te ■: to res: can or 

Appellant respectfully asserts thai the excerpt from Grope relied upon by the Examiner merely 
discloses that "data to be from a source computer to a scanning 

computer" where '"[t]he scanning computer then scans the data and creates a ion, file identifying 
portions of the data that have predetermined characteristics indicating a particular specified 
content'" (emphasis added) However, die mere disclosure that the data to be scanned is 
transferred to the scanning computer where the scanning computer then scans the data and 
creates a log tile, as in Gmpe, fails to even suggest a technique "wherein additional data to he 
scanned by the scanning co-processor is queued while waiting for the results from the scanning 
co-processor " (emphasis added), as claimed by appellant Clearly, transferring the data to be 
scanned and then scanning the data, as in Grope ; fails to suggest 'Igueuing] addidonaj .data to be 
scanned. . . while watting for the results from the scanning coprocessor 5 " (emphasis added), as 
claimed by appellant. 

The Examiner is reminded that a claim is anticipated only if each and every element as set forth 
in the claim is found, either expressly or inherently described in a single prior art reference. 
Venkgoai Bros, v. Union Oil Co. Of California. 814 F 2d 628 ; 631, 2 USPQ2d 1051, 1053 (Fed. 
Cir. 1987). Moreover, the identical invention must be shown in as complete detail as contained 
in the claim Richardson v. Suzuki Motor CoMB F.2d 1226, 1236, 9USPQ2d 1915, 1920 (Fed 
Cir 1.989). The elements must be arranged as required by the claim. 

This criterion has simply not been met by the Grope reference, especially in view of the 
arguments made hereinabove. 



Group 42: Claims 2 and 18 
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The Fvwimei has tehed on Paiagiaph 00 1 ^ Horn (nupe to make a pnot <u\ showing of 
appellant s claimed v piocessmg the data utilizing the central ptoeessing umt upon tbc receipt oi' 
faxnrable results from the scanning co-pioeessot including a situation where malicious code is 
not detected." 



[ - 1 ^ - ^ 1 , ! ^ [ < ^ 1 . log reading 

logic operable to control said source computer to read a log file 
written by a scanning computer, said log file identifying portions of 
said computer data having said predetermined characteristics ; and 
response logic responsive to said log tile and operable to control said 
source coirg>uter to periorm further processing tasks upon at least said 
data identified in said log file as laving said predetermined 
characteristics ' > •> - i > i 

Appellant lespecrfuih assetts that theevcerpt horn ( tupc jelied upon b\ the FXammei mcteK 
discloses that log leading logic [is] operable, to control said sotnee computer to read a logjilo 
fatten In a scanning computet j where) said log file identiff . iesj portions ut said computei data 
ha\ im> satd predetermined characteristics (emphasis, added) luithei Otupc discloses thai said 
soukc computet peilotm|V| lutthet processing tasks upon at least said data identified tn said 
iog ille as ha\ mg said ptedetei mined cliaiaetensries (emphasis ddcledt ilov e\et the meie 
disclosure oi pertojming furthei processing tas{ s upon a log tile which identities poiuons oi 
computes data haung predetermined chaau terisues as in Grape, fails to ex en suggest 
pioi-essing the data utilizing tin. central processing unit upon the receipt of i n otalile results 
iiom the scanning, eo-pt ocessoi including a situation \\ hcie malicious code is not detected ' 
(emphasis udded) as claimed h\ appellant 

In thi. Office Action mailed Os 01 "\00o the hammer digued that the log file allows ilu user lo 
ascertain which data is malicious {needing te~scamung ) and [t jhe othei data is clean 
Vppellant icspedu llv disagrees and asseits that Grape met el \ discloses that said k% file 
i dent iff tes | portion^ of said compmei data ha\ i n ii said pa detci nunc d c hat actei istrcs f em ph asi s 
added) (dearh , idtntils mg poitions of computet data ha\ mg piedetermmed characteristics, as 
in Grape, fails to even suggest "the receipt of faypxaMg.resMts.from 
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ineiuding a situation where malicious code is not detected " (emphasis added), as claimed by 
appellant 

Further, the J- \ amine i argued that there ts no definitive standard tot aster ratmnu what constitutes 
"fa\ orabk results and ' unfas otable results f hn\e\ ei appellant respectfuiU asserts that 
appellant claims ' uniau>rabie results' as 'including a situation viliuc maliuous imk is 
detected" (emphasis added) and 'ias otable results ' as ' including a situation w bete maltcsous 
code is not detected (emphasis added) CIcarK, appellant s ciarmed techniques set the standard* 
for "favorable results" and "unfavorable results." 

•Warn, appellant respectfulh asserts that appellant's specific ciarm language ts not anticipated by 
the Grupe reference since ail nt appellant's claim limitations have not been met b\ the Grupe 
reference, as noted above. 

Groifp #5; Claims 8 ami 24 

1 he t vimsnei has ttlred on Paragraphs <n)]0 and 001 1 in Grupe to make a pnoi art showing ot 
appellant s claimed technique ^htttm tht e\eut is initiated undo? the tontto] ot tht scanning 
control logic. 

t x <, Y Y » ^ > , it is preferable that the computer 

progxam product comprises log transferring logic operable to control 
said scanning con^mter to transfer said log file, vid d network 
connection to said source computer . 



Vpdlant RspectfuSK asstits that log transferring lo su t [ts] operable to tontiol said siannmg 
tomputet tt> tratister said log 111c % ia a network connection to satd souut torn putt r (emphasis 
added) Houexet tht mett drselosutt that log transit rung iogu uansfus the los/ Ok dom tht 
st aiming compute! to (he sourte computet tails to even suggest a technique nbuem the exent is 
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muidted under the eouttoi of the scanning eouttoi iogn. {empiwsis ddded) as claimed h\ 
appellant.. 

Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group $4: Claims 12 and 28 

The f ^ammet has tehed on Paragraphs t>(H 1 and <M2S m drupe to niaU a pi tot art sluuung oj 
appellant s claimed tLLhniqiK wherein \ ii lis smuaUiies ne stored m the memoix 



1 As the network 

large, the amount of processing time 
file agai ist an nciea^ug number of 
^xtrenaaly long ^ ^ *■ 1 



storage device 18 can be very 
required to compare every stored 
virus def initio i protiles can be 



Appellant respectfully asserts that the excerpts front Grupe relied upon by the Examiner merely 
disclose that "[ajs the network storage device 1.8 can be very large, the amount of processing 
time tequired to cpnipare against ;m increasing number of virus definition 

pt utiles can be extremely Song ' (emphasis added). However, the mere disclosure in Grupe that 
the stored files are compared against an increasing number of virus definition profiles fails to 
teach a technique "wherein virus signatures are stored in the memory" (emphasis added), as 
churned by appellant 
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Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group #5; Claims 34 and- 35 

f urtheimoie the txarntnei has lehed on Paiauiaph 0Ots> ftom Gutpe to make a puoj ait showing 
ot appellant s claimed queuing additional data to be scanned In the .scanning co-pi octroi 
whtk waiting foi the tcsiilts ftom the scanning eo-pioeessoi ' (see this oi snnthn but not 
necessatth identical language tn the independent Claims ^4 and 



this problem embodiments of the invention transfer data to b« scanned 
from a sonrce computer to a scanning computer. The scanning computer 
then scans the data and creates a log file identifying portions of the 
data that have predetermined characteristics indicating a particular 
specified content " ^ - I " * 



Appellant lespeuluih ast,eib that the c\teipt from Gntpe tched upon b\ the f ^ armner tmreh 
discloses that data to be scanned [is ttansienedj fiom a soutce computes tu a scanning 
computer v heie j t ] he scanning compute! then scans the data and eieates a log Die identify iny 
poitfons ot tht data that have ptcdctumincd chai act*. n sties, indicating a particular specified 
content ' (emphasis added) However, the mere disclosure in (tiupe that the data to be scanned is 
translated to the scanning computer where the scanning computer then scans the data and 
eteates a log file fails to esen surest queuing additional data to be scanned bv the scanning co- 
pioitisot while waning foi the tesults from the scanninu co-proce»sof {emphasis added) as 
claimed b\ ippeilant CkaiK ti iitstViimg the data to be scanned and then scanning the data is 
m Grupe fails to suggest 1 queuing additional data to be scanned while waiting foi the results 
ftom the scanning co-proccssor < emphasis added) as claimed b\ appellant 

fuithci the Pa ami net has jched >in Paragraph UOf > from Grupe to malu a ptiot ait shovung of 
appellant s claimed v ptoccssmg the data utilizing the central processing umt upon the receipt of 
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favorabie results from the scanning co-processor including a situation where malicious code is 
not detected"' (see ibis or similar, but riot necessarily identical language in the independent 
Claims 34 and 35). 



;;o«:-i speci f:i v:d content, said computwi - p-ogiij.-n corapi:i sine; : log reading 
logic operable to control said source computer to read a log file 
written by a scanning computer , said log file identifying portions of 
said computer data having said predetermined characteristics; and 
response logic responsive to said log file and operable to control said 
source computer to perform further processing tasks upon at least said 
data identified in said log file as having said predetermined 
characteristics." ; Paragraph 001 S •• emphasis added} 

Appellant respectfully asserts that the excerpt from Grupe relied upon by the Examiner merely 
discloses that "log reading logic [is] operable to control said source computer to read. a Jog.ft|e 
M.lMn bx^ [where] said lo^fije.jderjtij^ies] portjoas of sajd co 

having said predeterm t ned ch a racteri sties " ' (emphasis added). Further, Grupe discloses that ' said 
source computer ... perform [s'j further processing tasks upon at least said data identified in said 
log file as having said predetermined characteristics'" (emphasis added) However, the mere 
disclosure of performing further processing tasks upon a log file which identifies portions of 
computer data having predetermined characteristics, as in Grupe, fails to even suggest 
"processing the data utilizing the centra! processing unit upon the receipt of favorable results 
from the scanning co-processor including a situation where malicious code is not detected'" 
(emphasis added), as claimed by appellant. 



in the Office Action mailed 05/0 1/2006, the Examiner argued that "the log tile allows the user to 
ascertain which data is malicious {needing re-scanning)"' and '"[fjhe other data is clean." 
Appellant respectfully disagrees and asserts that Grupe merely discloses that '"'said log tile 
A^en ti.fli esj portion s.ollsay.. comj^iite^r data havi ng sai d predeTejm.in ecj. c hjracten^i cs" " (em phasi s 
added). Clearly, identifying portions of computer data having predetermined characteristics fails 
to even suggest "the receipt of favorable results from the scanning co-processor including a 
situation where (emphasis added), as claimed by appellant 
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Again, appellant respectfully asserts that appellant's specific claim language is not anticipated by 
the Grupe reference since all of appellant's claim limitations have not been met by the Grupe 
reference, as noted above. 

Group M: Claim 38 

I he f rammer lias tehed on Paragraph oo^o m Grupe to make a pttot art showmu of appellant s 
claimed td hmque whuein the < meru ?s turthei based on a u*>ei 



<.-^ ~ * " j-i 'O " ~, ezt&odiments o£ the 

above invention can be used to detect any content of a file that the 
user specifics. , *» n 1 .. ^ 



\ppcllani respectful! \ asseits that the excerpt hum Guipt* relied upon h\ tSie I \ammct teaches 
that embodiments oi the abos e m\ euuori can be used to detect am content ot a file that the ut>er 
sptutivs Hov\e\et detcvtini> usci specified content ol a ftk as in Gtupt tads to even surest 
a teehmejue wherein the uitena is turthci based on a usu {emphasis added) <rs claimed bs 
appellant. 

\aain appellant icsptcttulK as->ert-> that appellant ■> ■vpeeitle claim iauguage ?s not anfn ipated bv 
the GRipt. ai'eteiKe smee all ot mpeilant s chum limitations ha\e not been met bs the Game 
reference, as noted above 



Group ; 



The ! Aammei has relied on 1 ar.tgr.tph 00 >o in Grupe to make a ptiot ait sliuutna of appellant ^ 
claimed technique \\ herein the ctttena ss furthet based on soltwate logic jun bs a bros 



<fr'- vtv. , i j 'Usf-- < , >o w <,. <s embodiments of the 

above nvention can be used to detect niy conte it of a file that the 




Appellant respectfully asserts that the excerpt from Gntpe relied upon by the Examiner teaches 
thai ''embodiments of the above invention can be used to detect any content of a file that die user 
specifies /' However, detecting user specified content of a file, as in Grupe. fails to even suggest 
a technique "wherein the criteria is further based on software. jogjc £un bv.a.bipjT (emphasis 
added), as claimed by appellant. 



Agam. appellant tespectfulh assens that appellant's specific clam-) language is not anticipated by 
the Grupe iUetenee sjulc all of appellant s claim limitations ha\e not been met b\ (he Grupe 
reference, as noted above. 



Group Claim 44 



Hie Examiner has relied on Paragraph 0016 in Grupe to make a prior art showing of appellant's 
claimed technique "wherein the central processing unit aids the scanning co-processor when a 
large amount of data is to be scanned." 



i t = ' t t t , said romputei program 

product bem operable to control said source computer to transmit at 
least one further traction ox said data to at least one further 
sea mng compute! and to control said source com uter to receive a log 
file from each of saxd at least one further scanning computers 



Appellant respecttulK asserts that theevcerpt hom Grupe iched upon bv the I \aminet kaches 
that said computes program pioduct being opuabSe to control saul source computer to transmit 
at least one further tiauion ot said data to at Seat>t one further scanning computer and to tontioi 
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said souice computer to reeehe a iou file ftom each of said at least one further scanning 
computet s (emphasis added) Howes et the mete disclosure thai the source computer transmits 
one fintbei fraction of saul data to «it least one fuithet scanning computer, as m Giupe, fads to 
even suggest a technique "wherein the central pnx'essing unit aids the scanm n» co-processor 
when a large amount of data is to he scanned" {emphasis added), as claimed bs appellant 
Clear h transmitting a fraction of data to sesetal scanning computer as in (irupe fads to 
suggest that the "the central ptocessmg unst aids the scanning co-processot * (emphasss added), m 
the manner as claimed by appellant. 

Vg.iiri appellant iespectfulK asseits that appellant s specific claim lanyuaye is not anticipated b\ 
the (iiupe sefctence since al| of appellant s claim limitations ha\e not been met h\ the Giupe 
reference, as noted above. 

Issue 3 : 

'1 he i \ammer has rejected ( ianns l, h> So 41 and 4 ? under ^ X S C It) ?(a) as hems} 
unpatentable over Gtu pc et a I (f S Publication No 2002/019 4212) m \ie\\ of /uta 
(Intunatiotial Publication No \\ O 4, 8/4 (? "'7R) 

Group #7; Claims 3, .19, and 43 

Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue ^2, Group #3 above. 

Group #2; Claim 36 

Appellant respectfttlb asseits that such claims base not been meth\ the ptiot art bs urtue of the 
arguments made m Issue ->2 % ( houp ^ abuse 



Group M3: Claim 4! 
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The Fxammei lus tehed on page 24, lines l-» m 7uta to make a pnot ait shovunu of dppeilanFs 
0] dinted technique vtheiun the scanning cuntiui logn. is executed dutouumcalK when a 
computer is booted up." 

file operations or I/O. The smart verification is detailed below.'" 

Appellant respectfully asserts that such excerpt merely discloses that at power-up "the controller 
21 loads known viruses pattern as well as sensitive operations which demand further scrutiny."" 
nearly, loading a "known viruses pattern^ and "sensitive operations which demand further 
scrutiny >_ at power-up, as in Zuta, tail to teach a technique "wherein the scanning control logic is 
executed automatically when a .computex^ (emphasis added), as claimed by 

appellant. 

To establish & prima facie case of obviousness, three basic criteria must be met. First, there must 
be some suggestion or motivation, either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art, to modify the reference or to combine 
reference teachings. Second, there must be a reasonable expectation of success. Finally, the prior 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. In re 
Vacck.941 I<.2d488, 20 USPQ2d 143S (Fed.Cir. 1991 ). 

With respect to the first element of the prima facie case of obviousness and, in particular, the 
obviousness of combining the aforementioned references, the Examiner argued that it would 
have been obvious to one of ordinary skill in the art at the time of invention to incorporate the 
ideas of Zuta with those of Gmpe and add the use of a bus between the CPU of the first computer 
and the scanning co-processor of the second computer because a bus is a commonly used method 
of transmitting data between two units Appellant respectfully disagrees with such statement, 
especially in view of the vast evidence to the contrary 
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fot example, the fX-mimci Cnls to cite speciilc itiu!t^ ation in the abo\e tefuences to support the 
ca.se fot combining the same The Pennine? js temnuied thai the 1 edetal Circuit requites that 
thete must be some logical ieason apparent ftoni the <_\ idence of recoul that would justifv The 
combination Oi modification of references In rc Rcgci 18S I Si'Q 132 tCCP \ r^S) 

\ppclhnit tespeUiulh assuts t!i<it at least the first and third element oi the/'///Wt/ A^K' ease of 
ob\iousness h<i\e not been met since it would be w>ofatous to combine the ieferences, as noted 
ahose and the prior an refeicnces when combined fail to teach <>r >u^acst all <>{• the claim 
limitations, as noted above. 

Issue #4: 

'1 he h\'aminei has rejected C la?m ?7 under i c I S C 10 ?(a) at. bemu unpatentable o\ei Grupe ct 
al {I S Publication No 2002/0 i<>12! 2 >, in \ieu of Sna\ety {Sna\ei\, Allan, TnUsui, Dean 
Sxmbtottc Johsdieduling for d Simultaneous Muitithteadmg Processor Published in the 
1'ioeecdmgsoi \SPH)SiX Nmotibei 2W>) 

Group §1: Claim 3? 

Appellant respectfully asserts that such claims have not been met by the prior art by virtue of the 
arguments made in Issue #2, Group £5 above. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending {herefrom. 
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VIII CLAIMS APPENDIX (37 C.F.R. § 4i37<cXl)(viii)) 

The text of the claims involved in the appeal (along with associated status information) is set forth 
below: 

1. (Preuoush Pi esented) A method ibt scanning data compiling 

a) executing scanning eontio! logic utilizing a ceutial piocessmg umt, 

b) ldcmifrS ing a request i elated to data at the ceutial pmeessing unit, 

c) indicating the data to a scanning co-processoi coupled to the cents al processing una so 
that the data js scanned h\ the scanning co-pun. essoi under the coutioi of the scanning 
control logic; 

d) waiting foi Jesuits ik>m the scanning co-processoi , 

e) executing additional logic utilizing the centra! piocessmg unit while waning for the 
results fiom the scanning co-pioeessor, and 

f) initiating an e\ent based on the lesults fiom the scanning co-pioeessor 

w herein the scannmg eo-pux.es sor is under the eonUol of die central pux.essmg unit ^ ia 
the execution of the seanmrm control logic b\ the central processing unit, 
v.heiein it is determined whether the data meets a ptedetermmed criteria, v.heiethe 
catena is based on a is pe of a file associated with the data 

whet em the data is sent to the scanning eo-proeessoi if it is determined that the data 
meets the predetet mined cutena, 

wherein additional data to he scanned b\ the scanning co-processor is queued uhtle 
waiting for the results from the scanning co-processor. 

2. (Preuoush Presented^ Hie method as recited m claim 1 and tuither computing 
processing the data utth/tng the cent tat processing unit upon the icceipt oi fax or able 
lesults fiom the scanning co-pioeessor including a situation v\heie malicious code is not 

detected. 



3. 



(Original) The method as recited in claim 1, wherein the central processing unit is 
coupled to the scanning co-processor via a bus. 
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4. (Original) The method as recited in claim 1, wherein the scanning control logic includes 
hardware 

5. (Origi nat) The method as recited in claim 3, wherein the scanning control logic is stored 
on the scanning co-processor. 

6. (Original) Hie method as recited in claim 1, wherein the scanning control logic includes 
software. 

7. (Original) The method as recited in claim 6, wherein the scanning control logic is stored 
in memory. 

S. (Ouginai ) The method as tecited in claim \ wheiem the event is initiated undei the 
contiol of the scanning conttol logic 

9. (Ongmal ) 1 he method as tecited in claim 1 % wheiem the scanning eo-processoi pesfoims 
content scanning. 

10. (Original) The method as recited in claim 1 , wherein the scanning co-processor performs 
virus scanning. 

1 1 . (Original) The method as recited in claim 1 , wherein the scanning co-processor includes 
memory. 

12. (Original) The method as recited in claim 11, wherein virus signatures are stored in the 
memory. 

13. (Original) The method as recited in claim TL wherein rule sets are stored in the memory. 

14. (Cancelled) 



15. (Cancelled) 
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16, (Cancelled) 

17. (Previously Presented) A computer program product for scanning data, comprising: 

a) computer code for executing scanning control logic utilizing a centra! processing unit; 

b) computer code for identifying a request related to data at the central processing unit; 

c) computer code for indicating the data to a scanning co-processor coupled to the central 
processing unit so that the data is scanned by the scanning co-processor under the control 
of the scanning control logic; 

d) computer code for waiting for results from the scanning co-processor; 

e) computer code for executing additional logic utilizing the central processing unit while 
waiting for the results from the scanning co-processor, and 

f) computer code for initiating an event based on the results from the scanning co- 
processor; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein it is determined whether the data meets a predetermined criteria, where the 
criteria is based on a type of a file associated with the data, 

wherein the data is sent to the scanning co-processor if it is determined that the data 
meets the predetermined criteria; 

wherein additional data to be scanned by the scanning co-processor is queued while 
waiting for the results from the scanning co-processor 

i 8. (Previously Presented) The computer program product as recited in claim 1 7, and further 
comprising computer code for processing the data utilizing the central processing unit 
upon the receipt of favorable results from the scanning co-processor including a situation 
where malicious code is not detected. 

\9. (Original } The computer program product as recited in claim 1 7, wherein the centra! 
processing unit is coupled to the scanning co-processor via a bus. 
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20 (Original) The computer ptugiam product as i ucttcd in claim I "* wherein the scanning 
control logic includes hardware. 

21. (Onyni.il) i he computet piogiam product as iccstcd m claim 20, whet em the scanning 
coiUi^l logic ts stored ^n the scanning cO~pt<vcssot 

22. (Onguial) The computet pi ogiatn product as seated m chum 17, whet em the scanning 
contiol logic includes yttware 

2^ (Otiginai » The computet progtam product as recited m claim 22, uhetein the scanning 
contiol logic is stored tn memot\ 

24 (Ongrnai ) The computer program ptoduct as recited m claim 1 7, wherein the c\cm ii> 
initiated under the control of the scanning control logic- 

2^ (Ormrnai ) 1 he computet ptogram ptoduct as teated in claim 1 7. whet em the scanning 
co-pi occssor performs content scanning 

2(i (Original) 1 he computer pi ogr am ptoduct as tccitcd m claim I" w her em the scanning 
co-processor performs virus scanning. 

27. (Original) The computer program product as recited in claim 1 7, wherein the scanning 
co-processor includes memory. 

28. (Original) The computer program product as recited in claim 27, wherein virus signatures 
are stored in the memory, 

29. (Original) The computer program product as recited in claim 27, wherein rule sets are 
stored in the memory. 



30. (Cancelled) 
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3 1 . (Cancelled) 

32. (Cancelled) 

3^ (Piewousl\ Piesentcd) A s\stem Tot scanning data comprising 

<0 logic fot executing scanning control logic utilizing a cential processing unit, 

b) logic for filevmi\ mu a request related to data at the cential processing unit, 

O logic for indicating the data to a scanning co-processoi coupled to the central processing 
unit so that the data is scanned b\ the scanning eo-ptoeessoj under the control ot the 
.scanning control logic: 

(!) logic for w dtting foi Jesuits in mi the scanning co-piocessor 

e) logic foi evecutrma additional loetc utilizing the central processing unit while waiting to* 
the results from die scanning co-pi ocelot, and 

f) logic foi initiating an e\ etit based on the results from the scanning eo-pioeessor 

whet em the scanning co-processoi is under the contioi of the cential processing unit vta 
the execution of die scanning control Some b\ die central processing unit, 
wherein it is determined whether the data meets a predetermined enter ta, where the 
entena is basid on a t\pe of a file associated with the data, 

wherein the data is sent to ihe scanning co-processor \i it is determined that the data 
meets the piedetermined entena, 

wherein additional data to be scanned b\ the scanning co-processor js queued while 
waiting f<n the results from the scanning co-ptocessot 

34 (Pre\iousls Presented) A method lot scanning data comprising 
a) esecutiiiu scanning contioi logic utilizing a central pioeessmg unit, 
h) ldciiulS ing a request related to data at the central processing unit, 

c) determining whether the data meets a piedetermmed entena utilizing the cential 
piocessmg unit under die control ot the scanning control logic 

d) indicating the data to a scanning co-processoi coupled to the cents al processing unit if it 
is detc-i mined that the data meets the predetermined criteria, 

e} collecting scanning information tiom inemors on the scanning co-proeessot , 
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f) scanning the data with the scanning co-processor utilizing the scanning information under 
the control of the scanning control logic; 

g) waiting for results from the scanning co-processor; 

h) executing additional logic utilizing the central processing unit while waiting for the 
results front the scanning co-processor; 

i) queuing additional data to be scanned by the scanning co-processor while waiting for the 
results from the scanning co-processor; 

j) initiating a security event upon the receipt of unfavorable results from the scanning co- 
processor including a situation where malicious code is detected; and 

k) processing the data utilizing the central processing unit upon the receipt of favorable 

results from the scanning co-processor including a situation where malicious code is not 
detected, 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherei n the criteria is based on a type of a file associated with the data. 

35. (Previously Presented) A system for scanning data, comprising: 

a) means for executing scanning control logic utilizing a central processing unit, 

b) means for identifying a request related to data at the central processing unit; 

c) means for determining whether the data meets a predetermined criteria utilizing the 
central processing unit under the control of the scanning control logic; 

d) means for indicating the data to a scanning co-processor coupled to the central processing 
unit if it is determined that the data meets the predetermined criteria; 

e) means for col lecting scanning information from memory on the scanning co-processor; 

f) means for scanning the data with the scanning co-processor utilizing the scanning 
information under the control of the scanning control logic; 

g) means for waiting for results from the scanning co-processor; 

h) means for executing additional logic utilizing the central processing unit while waiting 
for the results from the scanning co-processor; 

i) means for queuing additional data to be scanned by the scanning co-processor while 
waiting for the results from the scanning co-processor. 
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j) means for initiating a security event upon the receipt of unfavorable results from the 
scanning co-processor including a situation where malicious code is detected; and 

k) means for processing the data utilizing the central processing unit upon the receipt of 
favorable results from the scanning co-processor including a situation where malicious 
code is not detected; 

wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit; 
wherein the criteria is based on a type of a file associated with the data. 

36. (Original) The system as recited in claim 35, wherein the scanning information is updated 
via a network periodically. 

37. (Original ) T'he s\ stem as recited in claim 35, wherein the additional logic to he executed 
and the additional data queued to be scanned are handled tmii/mg muht-thieadmg 
algorithms. 

38. (Previously Presented) The method as recited in claim 1, wherein the criteria is further 
based on a. user. 

39. (Previously Presented) The method as recited in claim 1 , wherein the criteria is further 
based on software logic run by a bios. 

40. (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic Is executed automatically, 

41 . (Previously Presented) The method as recited in claim 1, wherein the scanning control 
logic is executed automatically when a computer is booted up. 

42. (Previously Presented) The method as recited in claim 1 , wherein the scanning control 
logic is executed manually by a user. 



( Pi e\ iuush Presented) The method i ccitcd m claim 1 , \\ heiem the scanning eontiol 
logic is executed using soAware logic run b\ a bios 

(Previously Presented) The method as recited in claim I, wherein the central processing unit 
aids the scanning co-processor when a large amount of data is to be scanned. 
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IX EVIDENCE APPENDIX (37 C.F.R. § 41.37{c){l)(ix)) 

There is no such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 407(c)(l){x)) 

Since no decision(s) has been rendered in such proceeding(s), no material is included in this 
Related Proceedings Appendix. 
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